PGP signature on Maven Central seems to be incompatible with current Gradle/bouncycastle versions

[cseewald]

Expected Behavior

I would like to be able to verify db-scheduler.jar with Gradle Dependency Verification with the PGP signature on Maven Central.

Current Behavior

If I enable dependency verification (https://docs.gradle.org/8.5/userguide/dependency_verification.html) I get an exception in the gradle build which hints at a broken/incompatible PGP signature.

class org.bouncycastle.openpgp.PGPCompressedData cannot be cast to class org.bouncycastle.openpgp.PGPSignatureList (org.bouncycastle.openpgp.PGPCompressedData and org.bouncycastle.openpgp.PGPSignatureList are in unnamed module of loader org.gradle.initialization.MixInLegacyTypesClassLoader @15a04efb)

The error is only reported if db-scheduler is added as a dependency and only if it is version >= 12.0.1.

See https://github.com/cseewald/db-scheduler-client

Context

• DB-Scheduler Version : 14.0.3
• Java Version : 17
• Spring Boot (check for Yes) : [ ]
• Database and Version : none